From 7e94eea57d11795c88fc88124be43e5cd7af0636 Mon Sep 17 00:00:00 2001
From: Tim Terriberry <tterribe@xiph.org>
Date: Wed, 13 Oct 2010 20:22:50 +0000
Subject: Forward port r14598 from libvorbis.

Add code to prevent heap attacks by exploiting dim==bignum and
 partition_codewords==partion_values^dim.


git-svn-id: https://svn.xiph.org/trunk/Tremor@17513 0101bb08-14d6-0310-b084-bc0e0c8e3800
---
 res012.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/res012.c b/res012.c
index 03e150d..6c1d4e1 100644
--- a/res012.c
+++ b/res012.c
@@ -113,6 +113,20 @@ vorbis_info_residue *res0_unpack(vorbis_info *vi,oggpack_buffer *opb){
   for(j=0;j<acc;j++)
     if(info->booklist[j]>=ci->books)goto errout;
 
+  /* verify the phrasebook is not specifying an impossible or
+     inconsistent partitioning scheme. */
+  {
+    int entries = ci->book_param[info->groupbook]->entries;
+    int dim = ci->book_param[info->groupbook]->dim;
+    int partvals = 1;
+    while(dim>0){
+      partvals *= info->partitions;
+      if(partvals > entries) goto errout;
+      dim--;
+    }
+    if(partvals != entries) goto errout;
+  }
+
   return(info);
  errout:
   res0_free_info(info);
-- 
cgit v1.2.1